DarkSword iPhone Spyware Leaked Online. Here’s How to Stay Safe

Your iPhone might be at risk right now, and you don’t have to click a sketchy link to get hit.

Cybersecurity researchers from Google’s Threat Intelligence Group, along with two security firms — Lookout and iVerify — have identified a powerful new hacking toolkit called DarkSword. It targets iPhones in a sneaky way most people wouldn’t expect. And now that it’s publicly available online, the threat just got a whole lot bigger.

Here’s what’s happening, why it matters, and the simple steps you can take today to protect yourself.

DarkSword Doesn’t Need You to Click Anything Suspicious

Most hacking attempts you’ve probably heard about involve phishing emails or fake text messages trying to get you to tap a bad link. DarkSword works differently.

It uses what security researchers call a “watering hole attack.” Hackers build infected websites — some designed to look like Snapchat, others mimicking government contractor pages. You visit the site while browsing normally. That’s it. No suspicious download required.

“As a result, such attacks are not only stealthier but also more capable with respect to what data they can access on the device,” Christoph Hebeisen, Lookout’s director of security intelligence research, told CNET.

Once activated, DarkSword can access your messages, iCloud content, and even cryptocurrency wallets. So the potential damage here is serious.

![Smartphone screen showing iOS software update notification with security patch available, representing iPhone protection against DarkSword spyware]

Why Researchers Are Calling This “Extremely Worrisome”

So far, confirmed DarkSword attacks have targeted people in Saudi Arabia, Turkey, Malaysia, and Ukraine. Google identified it being used by “multiple commercial surveillance vendors and suspected state-sponsored actors.”

But here’s the part that changes everything. The toolkit has now been made publicly available on GitHub, first spotted by TechCrunch. That means it’s no longer limited to well-funded surveillance groups with sophisticated resources.

“Public availability of this kit is extremely worrisome given the high number of remaining active vulnerable devices,” Hebeisen said.

DarkSword was built to be flexible. Researchers describe it as adaptable for developers and casual coders alike. That means far more bad actors can now deploy it. “Opportunistic attacks using this exploit kit appear very likely,” Hebeisen added.

The phones most at risk are those running iOS 18.4 through 18.7. Apple’s own data shows about one-fifth of iPhone owners are still on iOS 18. That’s potentially millions of vulnerable devices sitting out there right now.

Apple Already Patched This. But You Have to Update

Apple wasn’t caught completely off guard. Google reached out to Apple in late 2025 with its findings, and Apple responded. In a support page published March 19, the company confirmed: “We thoroughly investigated these issues as they were found and released software updates as quickly as possible for the most recent operating system versions to address vulnerabilities and disrupt such attacks.”

In other words, the fix exists. You just need to install it.

Google confirmed that iOS 26.3, Apple’s latest software update, includes protections against DarkSword attacks. Apple also released iOS 26.3.1(a), a smaller security-focused update, on Wednesday. Both patches address the vulnerabilities DarkSword exploits.

If you’ve already kept your phone current, you’re protected. But if you’ve been putting off that update notification, now is the time to stop waiting.

How to Update Your iPhone Right Now

The process takes just a few minutes and could save you a serious headache later.

Open Settings, then tap General, then Software Update. If an update is available, your phone will prompt you to download and install it. That’s all there is to it.

“I always recommend people update their iPhone to the latest iOS software as soon as they can,” CNET expert Zachary McAuliffe said. “Updates usually include new features, but more importantly, they often patch security issues. Delaying an update means malicious actors could exploit a vulnerability on your iPhone, putting your personal data and system security at risk.”

![Step-by-step iPhone Settings menu showing the path to Software Update in General settings for installing iOS security patches]

Some older iPhone models can’t run iOS 26. Check Apple’s compatibility guide to see if your device qualifies. If you’re not eligible for iOS 26, Apple urges users to update to at least iOS 15, which includes security protections for older hardware.

One More Layer of Protection Worth Considering

Beyond keeping your software current, Apple also recommends enabling Lockdown Mode for users who want extra protection against malicious web content. It’s a more restrictive setting that limits certain iPhone features, but it significantly reduces the attack surface for threats like DarkSword.

Lockdown Mode isn’t for everyone. It disables some normal functionality. But if you’re particularly concerned or work in a sensitive field, it’s worth exploring.

For most people, though, the answer is simpler than it sounds. Keep your iPhone updated. That one habit blocks the vast majority of known threats — including this one. It’s genuinely the most powerful security tool most of us never think about until something goes wrong.

Don’t let DarkSword be the reason you finally do it.